Skip to main content
Questionnaires let you collect structured written responses from vendors by asking specific questions about their security program, controls, or practices. Unlike artifact collection (which relies on documents), questionnaires put questions directly to the vendor and capture their answers as a response artifact. You manage questionnaires in Settings → Questionnaires. Creating and editing questionnaires requires Admin or Program Manager access.

​
When to use questionnaires

Questionnaires are useful when:
  • A vendor doesn’t have formal audit reports and needs to self-attest to their security practices
  • You want to ask specific questions not covered by standard artifact types
  • Controls remain unvalidated after artifact review and you need targeted clarification
  • Your compliance program requires vendors to answer specific questions in writing

​
Creating a questionnaire

1

Navigate to Settings → Questionnaires

Click Add questionnaire to create a new one.
2

Select how to build it

  • Import — use the provided CSV template to define questions in bulk
  • Create — build the questionnaire question by question in the interface
3

Name it

Use a descriptive name. This is visible to vendors when they receive an assessment request containing the questionnaire.
4

Configure the response method

Select how to collect responses:Answer with AI — VISO AI answers the questions automatically from the artifacts on the vendor relationship, with source citations and confidence scores for each answer. Faster, no vendor effort required. You can still follow up with the vendor if clarification is needed. See AI-answered questionnaires.Require vendor response — VISO TRUST sends questions directly to the vendor during interactive assessments. The vendor answers in writing through the collection portal.
5

Set the default scope (optional)

Toggle Enable for every relationship to apply the questionnaire to all vendor relationships by default. You can override this default at the relationship level.

​
Managing questionnaire scope

​
Organization level

Questionnaires enabled at the org level apply to all new assessments by default. Go to Settings → Questionnaires to enable, disable, or edit questionnaires globally.

​
Relationship level

To include or exclude a questionnaire for a specific vendor:
  1. Open the vendor relationship
  2. Open the Relationship configuration dialog (gear icon) and go to Context → Supplemental questionnaires
  3. Use the slide toggles to turn individual questionnaires on or off
  4. Use Restore organization defaults to revert to org-level settings
Removing a questionnaire from a relationship excludes it from future assessments and hides responses in the risk analysis. Previously collected responses are retained.

​
Questionnaire results in assessments

When a vendor responds to a questionnaire, the response is:
  • Stored as a Questionnaire artifact in the Artifacts tab
  • Listed in its own section under Questionnaires in the relationship’s risk analysis, with completion progress and every question and answer
  • Analyzed by Artifact Intelligence to map answers to controls where applicable
Questionnaire responses carry Weak assurance because they’re self-attested by the vendor. For high-risk controls, validate questionnaire responses against documentary evidence where possible.

​
Follow-up questionnaires

VISO TRUST automatically generates follow-up questionnaires when controls remain unvalidated after artifact review. They target the specific gaps identified in the assessment rather than being a general questionnaire. You can configure follow-up behavior at three levels:
  • Always ask before following up — VISO TRUST prompts you to review and decide whether to send a follow-up
  • Conditional based on residual risk — automatically send a follow-up when residual risk is at or above a threshold (e.g., Medium)
  • Use assessment concierge service — VISO TRUST manages the follow-up on your behalf
The follow-up response window is configurable (7, 14, 30, 60, or 90 days; 7 by default). When you send a follow-up yourself, you can adjust its scope, recipient, message, and deadline. See Send a follow-up request. VISO TRUST auditors validate the responses (when the AI Assessment + Auditor Review method is configured) and update the assessment findings. See Assessment Settings to configure follow-up defaults.

​
One-off questionnaires

You can send a questionnaire as part of any individual collection request, even if it isn’t configured as a default. When starting a collection request, select Request manual response and then select the questionnaire to include. This lets you send targeted questionnaires to specific vendors without changing org or relationship defaults.